GPT-6 Astra Cuts Hallucinations, but Hidden Prompt Injections Still Break Through

OpenAI's GPT-6 Astra produces fewer hallucinations than GPT-5.6 Sol, according to the article's summary of OpenAI's system card. The test focused on ChatGPT conversations users had already flagged for wrong answers, so the reported cases were unusually error-prone rather than typical everyday usage. Astra also blocked 99.99 percent of direct prompt injection attacks, a major improvement for situations where users try to manipulate the model directly through prompts.

Astra refused harmful jailbreak attempts in 91.5 to 98.3 percent of cases on a fixed dataset covering biology, violence, and cybersecurity. The article notes that adaptive, multi-round attackers had more success: Astra's defense rate fell to about 67 percent, meaning persistent adversaries could still get at least one problematic response roughly one in three tries. OpenAI also noted these tests used the bare model without the production safety layers that ship with the actual product.

The larger unresolved risk is indirect prompt injection, where malicious instructions are hidden inside documents the AI reads. In external testing by Gray Swan using 1,810 curated attacks from IPI Arena, Astra was cracked at least once in 8.5 percent of scenarios after 15 attempts. That is a sharp drop from GPT-5.6 Sol's 27 percent failure rate, but Claude Opus 5 performed better at 4.8 percent in the same evaluation.

For enterprise teams, the takeaway is that lower failure rates do not equal secure deployment. The article highlights that agents increasingly write code, operate tools, control computers, and process documents, making indirect prompt injection a practical concern. A model that fails in roughly one out of twelve hidden-instruction scenarios can still create meaningful risk when deployed at scale or allowed to run continuously.